How much should a security company spend on marketing, and what should it measure?
There is no reliable published benchmark for what a security company should spend on marketing. The useful number comes from your own pipeline maths: the revenue you need, the deals that takes, and what each qualified opportunity costs to create.
How much should a security company spend on marketing?
Enough to create the qualified opportunities your revenue target needs, at a cost per opportunity your contract values can carry. Work backwards from the target: new revenue, divided by contract value, gives the wins you need; divided by win rate, the opportunities; and multiplied by cost per opportunity, the budget.
Percentage-of-revenue rules are a weak guide for security companies because contract values, sales cycles and channel mix vary so much. A pen-testing firm selling $25,000 engagements (an illustrative figure) and a platform vendor selling six-figure contracts can both be right with very different budgets. The general marketing budget guide covers the method for any B2B company; this page applies it to security.
How do you build a budget from target pipeline?
Use your own CRM numbers wherever you have them, and label the rest as assumptions to test.
- Set the new revenue target for the year from marketing-sourced deals.
- Divide by average first-year contract value to get the number of wins.
- Divide by win rate to get the qualified opportunities you need.
- Divide by lead-to-opportunity rate to get qualified leads.
- Multiply by cost per qualified lead by channel to get the budget.
- Add fixed costs: content, tools, events and agency or contractor time.
The calculator below follows one month of spend through the same steps. Change every input to your own figures; the defaults are not benchmarks.
Follow one month of marketing spend through qualified leads, opportunities, wins and contract value.
Illustrative estimate only. Every input is an assumption to replace with your own CRM data; the defaults are not benchmarks. Security deals often take months to close, so revenue from one month of spend arrives over the following quarters. The model ignores churn, expansion, discounts and the cost of sales. No result is guaranteed.
Want help finding which of these numbers moves pipeline most for your security company? ShoutEx can help you plan and run demand generation that sales trusts.
Talk to ShoutExWhat do LinkedIn and Google Ads need as a minimum?
Paid channels have floors and spending patterns that affect small budgets. LinkedIn says the minimum daily budget to start is $10 for any ad format, with a $100 minimum lifetime budget for new campaigns. In practice, reaching a narrow audience of security leaders often needs well above the minimum to get enough impressions to learn anything (ShoutEx view).
Google Ads budgets are averages, not hard daily caps. Google's help on overdelivery explains that a campaign can spend up to twice its average daily budget on a given day, while monthly spend is capped at 30.4 times the average daily budget. Plan cash flow on the monthly figure, not the daily one.
Channel specifics are in LinkedIn Ads for security companies and Google Ads cost. Neither page publishes cost-per-click benchmarks, because none we found for security keywords were reliable.
How should a security company split its budget across channels?
It depends on your company type and the buyers you chase. The split below is an example of shape, not a recommendation for your numbers.
Events and outbound often look expensive per lead but can produce the best opportunities in security, where relationships matter. See security events and ABM and email before cutting them on cost per lead alone.
Cost per qualified opportunity is the number to manage.
Leads are cheap and plentiful. Opportunities that pass discovery and survive security review are what pay for the marketing, so set targets there.
What does the Canadian market spend on cyber security?
Statistics Canada gives useful context for sizing a Canadian market. In its 2023 survey of cybercrime impacts, businesses spent $11.0 billion on cyber security prevention and detection, up from $9.7 billion, while recovery costs from incidents doubled from about $600 million in 2021 to $1.2 billion in 2023. Thirteen per cent of impacted businesses reported ransomware, and 88% of ransomware victims did not pay.
Those figures describe what buyers spend on security, not what vendors spend on marketing. They are useful in a business case or an investor deck to show that budgets exist and are growing, and in content that explains recovery costs without resorting to fear.
What should a security company measure?
Measure the steps between spend and revenue, with qualified opportunities at the centre. Lead counts alone reward the wrong things, such as student downloads and competitor sign-ups.
| Metric | What it tells you | Where it lives |
|---|---|---|
| Qualified opportunities created | Whether marketing creates real pipeline | CRM opportunity records |
| Cost per qualified opportunity | Efficiency by channel | Spend plus CRM |
| Security review pass rate | Whether trust material is ready | Deal notes, review outcomes |
| Sales cycle length | Where deals slow down | CRM stage dates |
| Win rate by source | Which channels bring buyers who sign | CRM closed deals |
| Pipeline by target segment | Whether positioning is landing | CRM account fields |
Mistakes to avoid
- Reporting marketing-qualified leads without checking how many became opportunities.
- Judging a channel after one month when deals take a quarter or more to close.
- Ignoring security review time, which often decides the quarter a deal lands.
- Copying a competitor's budget without knowing their contract values.
Frequently asked questions
What percentage of revenue should a security company spend on marketing?
There is no reliable published figure for security companies. Work backwards from your revenue target, contract value, win rate and cost per qualified opportunity instead.
What is LinkedIn's minimum ad budget?
LinkedIn states a minimum daily budget of $10 for any ad format and a $100 minimum lifetime budget for new campaigns.
Can Google Ads spend more than my daily budget?
Yes. A campaign can spend up to twice its average daily budget on a given day, but monthly spend is capped at 30.4 times the average daily budget.
What is a good cost per lead for cybersecurity?
We found no reliable benchmark. Use your own data and focus on cost per qualified opportunity, which reflects lead quality as well as price.
Which metric matters most for security marketing?
Qualified opportunities created, and the cost of each. Wins matter too, but they lag spend by months in most security sales cycles.
How long before marketing spend shows up in revenue?
Often several months, because security deals pass through technical evaluation, vendor review and procurement. Track opportunities in the meantime.
Should we track security review pass rate?
Yes. A low pass rate or long review times signal missing trust material, which marketing can fix with a trust centre and answer library.
Are the calculator defaults benchmarks?
No. They are illustrative assumptions. Replace every input with your own CRM figures before using the output.
Sources & further reading
Regulations, platform policies and market data change. These sources let you check the facts on this page, last checked October 7, 2026.